Virtual Network Function Service Chaining Anomaly Detection

Network function virtualization (NFV) and virtual network function (VNF) service chaining are receiving a significant attention from both academic and industry. However, most of attentions have been concentrated on delivering the flexible network architecture and optimization of VNF placement across the network infrastructure. In this paper, we focus on an important aspect of the network after its architecture is formed and its VNF placements are optimized. This aspect is related to the efficiency and effectiveness of VNF provisioning, lack of visibilities on the location of VNF, flexibility of VNF placement and VNF splitting into multiple sub-functions. This can be considered as a security issue covering the anomalies of the VNF orchestration and placement during the operation. We propose a VNF service chain anomalies detection method based on the Markov chain property in order to ensure the correctness of VNFs backward and forward placement and the K-means classification of VNF sequence patterns. This method identifies the patterns of VNF service chaining sequence in a correct behavior. This work is not just observing the existing network behavior, it also can be extended to identify the correctness of the sequence order of a new VNF service chaining request.